
GetAdd$ = test1.exe+11357
bp GetAdd$
SetBreakpointCommand GetAdd$, "scriptcmd call callbackForGetAdd"


BuildString$ = test1.exe+110AA
bp BuildString$, "BuildStringStart"
SetBreakpointCommand BuildString$, "scriptcmd call callbackBuildString"

BuildStringEnd$ = test1+1263C
bp BuildStringEnd$, "BuildStringEnd"
SetBreakpointCommand BuildStringEnd$, "scriptcmd call callbackBuildStringEnd"


//	addrIn = arg.get(1);
//	log "tid={tid()} time={GetTickCount()} BuildString Start ... eip={eip}, RVA={eip-mod.main()}, parm1={arg.get(0)}, parm2={arg.get(1)}, parm3={arg.get(2)}"
//	log "addr = {addrIn}"
//	retValue = mem.valid(addrIn)
//	log "addr = {addrIn}, mem.valid retValue={retValue}"
//	cmp retValue ,0
//	je invalid_address
//	log "valid  addr"



goto main

// 脚本的断点下了以后，后面的在脚本断点中间间隔的手动断点可能无法停下来。或者是在 rtr 过程中的断点无法停下来。需要测试。
//   如果是这样，可以采用在函数头尾分别下断点的方法。也可以尝试在需要断点下来的位置加msg弹框。
// 所有脚本断点启动之前，如果有断点，可能导致脚本断点无法执行。

// all callback start 


callbackForGetAdd:
   	log "GetAdd Start ... eip={eip}, RVA={eip-mod.base(test1)}, parm1={arg.get(0)},  parm2={arg.get(1)}, parm3={arg.get(2)}"
	//rtr
   	//log "GetAdd End ... eip={eip}, RVA={mod.rva(eip)}, parm1={arg.get(0)},  parm2={arg.get(1)}, parm3={arg.get(2)}"
	
	goto main



callbackBuildString:
	outBuf = arg.get(1)
   	log "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: BuildString Start ...  RVA={eip-mod.main()}, parm1={arg.get(0)}, parm2={arg.get(1)}, parm3={arg.get(2)}"
	
	// 判断outBuf是否为有效内存
	isValid = mem.valid(outBuf)
	log "addr = {outBuf}, mem.valid retValue={isValid}"
	
	// 测试直接访问空地址，没有崩溃，没有影响脚本的执行
	log "test access invalid addr, [outBuf]={[outBuf]}, string={ansi([outBuf])}"
	cmp isValid ,0
	je invalid_address
	log "valid  addr"
	
	// 判断outBuf所保存的数据是否为有效指针
	isValid = mem.valid([outBuf])
	cmp isValid ,0
	je invalid_address
	log "[outBuf]={[outBuf]}"
	
	//goto funEnd
	goto main
invalid_address:
	log "bad  addr"
	
	goto main
	
funEnd:
//	rtr
   	log "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: BuildString End ... eip={eip}, RVA={eip-mod.base(test1)}, parm1={arg.get(0)}, parm2={arg.get(1)}, parm3={arg.get(2)}"
	log "retvalue={eax}, str={ansi(eax)}"
	
	// 判断outBuf是否为有效内存
	isValid = mem.valid(outBuf)
	log "addr = {outBuf}, mem.valid retValue={isValid}"
	cmp isValid ,0
	je invalid_address2
	log "valid  addr2"
	
	// 判断outBuf所保存的数据是否为有效指针
	log "addr2 = {[outBuf]}"
	addr2 = [outBuf];
	log "addr2.. = {addr2}, str={ansi(addr2)}"
	isValid2 = mem.valid(addr2)
	log "addr2 = {[outBuf]}, mem.valid retValue={isValid2}"
	cmp isValid2 ,0
	je invalid_address2
	log "[outBuf]={[outBuf]}"
	log "ansi[outBuf] = {ansi[outBuf]}"
	
	goto main

//invalid_address2:
//	log "bad  addr2"
	
	
callbackBuildStringEnd:
	log "tid={tid()} time={GetTickCount()} RVA={mod.rva(eip)}: BuildString End ... eip={eip}, RVA={eip-mod.base(test1)}, parm1={arg.get(0)}, parm2={arg.get(1)}, parm3={arg.get(2)}"
	log "retvalue={eax}, str={ansi(eax)}"
	
	// 判断outBuf是否为有效内存
	isValid = mem.valid(outBuf)
	log "addr = {outBuf}, mem.valid retValue={isValid}"
	cmp isValid ,0
	je invalid_address2
	log "valid  addr2"
	
	// 判断outBuf所保存的数据是否为有效指针
	log "addr2 = {[outBuf]}"
	addr2 = [outBuf];
	log "addr2.. = {addr2}, str={ansi(addr2)}"
	isValid2 = mem.valid(addr2)
	log "addr2 = {[outBuf]}, mem.valid retValue={isValid2}"
	cmp isValid2 ,0
	je invalid_address2
	log "[outBuf]={[outBuf]}"
	log "ansi[outBuf] = {ansi[outBuf]}"
	
	goto main
	
invalid_address2:
	log "bad  addr2"
	

main:
	run
	
	
ret